Bug 1219064

Summary: [Build :31967:systemd] Error sending add rule data request (Rule exists)
Product: [openSUSE] PUBLIC SUSE Linux Enterprise Server 15 SP5 Reporter: Anton Smorodskyi <anton.smorodskyi>
Component: systemdAssignee: Enzo Matsumiya <ematsumiya>
Status: NEW --- QA Contact:
Severity: Normal    
Priority: P5 - None CC: fbui, pdostal
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://openqa.suse.de/tests/13307076/modules/img_proof/steps/34
Whiteboard:
Found By: openQA Services Priority:
Business Priority: Blocker: Yes
Marketing QA Status: --- IT Deployment: ---
Attachments: Journalctl output

Description Anton Smorodskyi 2024-01-22 15:14:11 UTC 
Created attachment 872064 [details]
Journalctl output

## Observation

openQA test in scenario sle-15-SP5-Azure-BYOS-Hardened-Incidents-x86_64-publiccloud_img_proof@az_Standard_B2s fails in
[img_proof](https://openqa.suse.de/tests/13307076/modules/img_proof/steps/34)

In journalctl output you may find following message : 

```
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed systemd[1]: Finished Apply settings from /etc/sysconfig/keyboard.
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed augenrules[641]: /sbin/augenrules: No change
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed augenrules[766]: Error sending add rule data request (Rule exists)
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed augenrules[766]: There was an error in line 65 of /etc/audit/audit.rules
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed augenrules[766]: No rules
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed systemd[1]: augenrules.service: Main process exited, code=exited, status=1/FAILURE
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed systemd[1]: augenrules.service: Failed with result 'exit-code'.
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed systemd[1]: Failed to start auditd rules generation.
```




## Further details

Always latest result in this scenario: [latest](https://openqa.suse.de/tests/latest?arch=x86_64&distri=sle&flavor=Azure-BYOS-Hardened-Incidents&machine=az_Standard_B2s&test=publiccloud_img_proof&version=15-SP5)
Comment 1 Anton Smorodskyi 2024-01-22 15:22:22 UTC 
1. Most probably related to incident http://dashboard.qam.suse.de/incident/31967
2. Issue happening during system boot 
3. As of now no functional regressions was found which may relate to this errors
Comment 2 Franck Bui 2024-01-23 08:58:35 UTC 
After some investigation on an affected system (thanks Anton for providing me access) it appears that the problem is unrelated to systemd as a manual "augenrules --load" shows the same error:

  Error sending add rule data request (Rule exists)
  There was an error in line 65 of /etc/audit/audit.rules

Reassigning to auditd maintainer.
Comment 3 Anton Smorodskyi 2024-01-23 10:17:16 UTC 
(In reply to Franck Bui from comment #2)
> After some investigation on an affected system (thanks Anton for providing
> me access) it appears that the problem is unrelated to systemd as a manual
> "augenrules --load" shows the same error:
> 
>   Error sending add rule data request (Rule exists)
>   There was an error in line 65 of /etc/audit/audit.rules
> 
> Reassigning to auditd maintainer.

Some clarification for auditd maintainer : **problem happens only in Hardened images **